From 14614548d92f261a5f7d660b91c2f0be9d890f94 Mon Sep 17 00:00:00 2001
From: sean <sean@radiq.my.id>
Date: Tue, 25 Aug 2026 19:34:51 +0700
Subject: [PATCH] fix: reject non-UUID auth identifiers from stale sessions
 before API calls

---
 app/Services/InsForge/InsForgeAuthService.php | 6 +++++-
 storage/framework/sessions/.gitignore         | 2 --
 2 files changed, 5 insertions(+), 3 deletions(-)
 delete mode 100644 storage/framework/sessions/.gitignore

diff --git a/app/Services/InsForge/InsForgeAuthService.php b/app/Services/InsForge/InsForgeAuthService.php
index 69bc40b..24d263d 100644
--- a/app/Services/InsForge/InsForgeAuthService.php
+++ b/app/Services/InsForge/InsForgeAuthService.php
@@ -46,9 +46,13 @@ class InsForgeAuthService
         return $this->hydrateProfile($profile);
     }
 
+    private const UUID_PATTERN = '/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i';
+
     public function profileById(?string $id): ?User
     {
-        if ($id === null) {
+        // Sesi lama bisa menyimpan identifier non-UUID (mis. "1") — jangan sampai
+        // mengirim nilai itu ke PostgREST; anggap tidak dikenal dan paksa login ulang.
+        if (! is_string($id) || preg_match(self::UUID_PATTERN, $id) !== 1) {
             return null;
         }
 
diff --git a/storage/framework/sessions/.gitignore b/storage/framework/sessions/.gitignore
deleted file mode 100644
index d6b7ef3..0000000
--- a/storage/framework/sessions/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-*
-!.gitignore